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The ultimate guide to bust fake tweeters: A video 
toolkit in 10 steps 


BY HENK VAN ESS - OCTOBER 4, 2017 


Gi lin) © hd TAGS: Verification fact-checking tips 


Twitter is full of false information. Even Twitter co-founder Ev Williams recognizes that there is a “junk information 
epidemic going on,” as "[ad-driven platforms] are benefiting from people generating attention at pretty much any cost." 


This video toolkit is intended to help you debunk dubious tweets. It was first developed in research by the Institute for 
Strategic Dialogue and the Arena Program at the London School of Economics to detect Russian social media influence 
during the German elections. It was also the basis for a related BuzzFeed article on a Russian bot farm and tweets about the 
AfD — the far-right party that will enter the German parliament for the first time. 


But first: Where do these bots come from? 
How Twitter bots are born Recommended Courses 


For an answer to that question I went into the dark web and 
returned with a software that claims to build scores of Twitter bots 
in hours. I used this highly illegal program just for a few minutes — 
for the sake of education. 


Getting It Right: Accuracy and 
a Verification in the Digital Age 
wy SELF-DIRECTED COURSE 


The software creates hundreds of new email-addresses on the fly, 
with fake names and locations. It feeds each email address into 


Twitter’s signup page and spits out random usernames. If the name s SciFacts: Fact-Checking Claims 
exists, another fake name is used. The software recognizes that [sci] facts About Science 
Twitter wants additional checks, like a telephone number. I didn’t Soy eh Kk FACT-CHECKINGSTORYTELLING 
have to do a thing. X ARE 
AIAR 
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How Twitter Bots Start 


O + 


Your browser does not currently recognize any of the video formats 
available. 


Click here to visit our frequently asked questions about HTML5 video. 


% YouTube 


I stopped after just 2 minutes and had created my first 10 bots, which means the software may be capable of producing 300 
bots per hour or 7,200 per day. 


You can direct your brainless bot army to a certain country, city or continent by replying to tweets of real users. Or you can 
let them all shout out the same hashtags so you become the Twitter equivalent of the talk of the town: a trending topic. 


Where is the money in all these fake accounts? Spam leads to ad revenue. And political tweets are bought by stakeholders, not 
merely through official ads but also through illegal bot farms. 


During my virtual visit to a commercial hacking and bot farm, I was promised by staffer “Alexander” to get a top 10 position 
in trending topics in Germany during election day on the hashtag #AfD. The costs were relatively low: $180. 


Alexander 
h Bbi ymeeTca pa36npaTb KOfbI NporpamMmnpoBaHna, TAKNE KAK 
c+? 
A Russian fake tweet specialist asks us how we wanted to have our army of bots: in C+? 


Professional spammers and influencers prefer to write software for a bot army from scratch, in a programming language 
called C+, the hacker told me. Twitter has even more problems with detecting “handmade” bots. Buying the C+-enabled 
software was very expensive, more than $10,000. 


How to fight the bots 
Let’s fight back! With the proper tools it’s possible to find out more about any Twitter account. and track down dubious bots. 
Tip 1: Find the exact minute of birth 


Our target in this article will be Huxonaii Kysnenoes (Twitter handle @adjust_ps). If you read all 10 tips, you will understand 
why he is probably a Twitter bot, part of a bot farm that has a professional staff of 31 coders and six managers. 


But first things first. 


If you go to the profile page of any Twitter user and hover over the “Joined” date you can get the exact date and hour of 
creation. Now you know when someone started tweeting. Sometimes a bogus eyewitness account is born minutes after a 
breaking news event to lure people searching for the latest information towards spam content. So it’s good to know when the 
account started. 


How to find exact date of Twitter account 


Q > 


Your browser does not currently recognize any of the video formats 
available. 


Click here to visit our frequently asked questions about HTML5 video. 


> {ò 0:00/0:05 % YouTube 


https://archive.ph/vThDV 


2/11 


5/1/24, 3:36 PM The ultimate guide to bust fake tweeters: A video toolkit in 10 steps | Poynter 


(Twitter Birthday does the same but doesn’t always respond. It also doesn’t respect your privacy, by showing your search to 
the rest of the world.) 


Now we know when the account started, we want to know: with what? 
Tip 2: Find the first words 


Here’s why it makes sense to go back in time with a suspicious Twitter account: A bot will often begin its life shamelessly 
selling ideas or products right away. 


You can find the first tweets through Advanced Twitter search, as shown in the video. Our guy just broadcasts links to 
YouTube videos in his first year and doesn’t interact with anybody. Link-spamming is the daily routine of bots. 


20% 


The first few tweets 


© A 


Your browser does not currently recognize any of the video formats 
available. 


Click here to visit our frequently asked questions about HTML5 video. 


Pm ò 0:00/0:20 % YouTube 


If you don’t shy away from more nerdy approaches, you can also type in an equivalent formula directly in the Twitter search 
box. Type “from:” followed by the username, leave a space and then type “since:" and “until:” to insert your date range. 


tal a a 
from:adjust_ps since:2015-05-25 until:2015-09-30 


This formula can be typed straight into Twitter search. 
Oddly enough, Twitter killed the service #firsttweet this year. 


Case use 


Let’s use tip 1 and tip 2 on another case. A Twitter account was very active during the final hours of the German vote. The 
user claimed irregularities during voting. People retweeted it. 


/ N 


Sahrer Y Follow ) 


@von_Sahringen 


Ich bin als Wahlhelferin berufen worden. Am Sonntag werden 
AfD Stimmen ungültig gemacht oy #BTW17Countdown 
#BTW17 #BTW2017 

5:57 PM - Sep 22, 2017 


O37 tTi39 © 125 (7) 


Screenshot, (original tweet may be deleted) 


The user claimed that AfD votes will be declared invalid. German authorities took it seriously. They officially replied to the 
user by saying that election fraud is not allowed and punishable. 
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Der Bundeswahlleiter ® (yy Follow ) 
@Wahlleiter_Bund ; 


Replying to @von_Sahringen 

Wahlfälschung ist strafbar. Der Wahlvorstand hat seine 
Aufgaben unparteiisch auszuführen. 

1:29 PM - Sep 23, 2017 


O14 e Q129 ® 


Screenshot (original link) 


30% 
Now here’s why you should go back to the exact time of birth of a Twitter account (tip 1) and find the first tweets (tip 2). 
When you do that, our (now suspended) user likes ..... to lick male genitalia without people noticing. 


Sahrer 
Volgen 
von Sahi i 


Als antwoord op @Ton_Balder @SPIRITO 


ich lutsche Penise von Leuten ohne dass sie 
es merken. 


We think this tweet could be deleted, so we screenshot it. 


With that, she loses (for most of us) credibility as being the best source for election fraud in Germany. 


So it makes sense to have a first look at the first tweet to understand the context. A dumb bot wants you to buy Viagra or a 


political idea right away. 
Tip 3: Check the followers 


Analyzing the followers of a Twitter account can be revelatory based on your expectations of the account. If you follow a 
German account who wants to stop German Angela Merkel being leader of the country, logic dictates that most followers are 
from Germany (as shown in video). 


But what do we expect from followers of our possible bot — a Russian guy who has posted a strange mix of ads, YouTube 
likes and support for German party #AfD? 


Geolocating Twitter Users 


@ A 


Your browser does not currently recognize any of the video formats 
available. 


Click here to visit our frequently asked questions about HTML5 video. 


% YouTube 


Professionally created bots — not the “dumb” ones that rote-tweet spam links and have no name and no bio — tend to use 
profile pictures of real people, a bio and often a link to other social accounts. 


To avoid spam detection, they choose their (automated) followers with care and spread them over all continents (as shown 
in the video). @Adjust_ps fits exactly that profile, so we’ll scrutinize him a little more in the next tip. Still, local users who 
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tweet in their own language usually don’t have followers evenly spread over every continent, so if they do, it’s reason for you 
to research them a little further. 


Tip 4: Find Twitter users in Facebook 


Another pattern I’ve found with professional bots is that their Twitter account and email address are similar because their 
setup is automated. For other social media accounts, they will use an e-mail address based on the handle of their Twitter bot. 


Let’s continue with our Russian account @adjust_ps. 


Possible email-addresses could be adjust_ps@yahoo.com or adjust_p@hotmail.com or adjust.p@gmail.com. 


Typing an email address directly into the search box of Facebook, searching and clicking on “People” will return the relevant 
user — if the user allows you to search by email. As the video shows, adjust.ps@gmail.com is the correct address and leads 
directly to the Facebook account of our target. He uses the same photo on Facebook as on Twitter. (The owner disabled mail- 
checking in Facebook after we published this article). 


Crosschecking Twitter accounts in Facebook 


40% Q a 


Your browser does not currently recognize any of the video formats 
available. 


Click here to visit our frequently asked questions about HTML5 video 


% Youlube ©: 


So what do you think of his Facebook account? Almost every post is a link, with no personal comment attached. He is in 
thousands of commercial groups from all over the world, which is like bot behavior. 


Buy and Sell - Quebec City 41 Join 


489 members 


Buy and Sell, BEXLEY, UK 41 Join 
Linked Group - Buy and Sell, UK 
d Anunturi MARGHITA, Romania 41 Join 


969 members 


Our target likes to buy and sell 
Tip 5. Find suspicious words in tweets 


Tweetbeaver helps you find all kinds of details on a user’s Twitter activity and allows you to export it to Excel. One helpful 
feature is to get a summary of tweets with a certain keyword in it with the exact moment of posting. Our guy, adjust_ps had 
several tweets about AfD. Why? 
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Find words in timelines 


O > 


Your browser does not currently recognize any of the video formats 
available. 


Click here to visit our frequently. uestions about HTML5 video. 


> ò 0:00/0:05 % YouTube 


Tip 6: Searching in big data 


Using Graphika to study tweets from Russia about the German elections revealed two major hubs. One of them was our 


target. 
50% 


Luca Hammer / FearlessDemocracy / Via fearlessdemocracy.org and Henk van Ess 


The graph shows all kinds of tweets that promote AfD and probably are Russian. @Adjust_ps and @gyroscope999 are the 
opinion leaders. 


Comparison of followers of adjust_ps & gyroscope999 


Luca Hammer / FearlessDemocracy / Via fearlessdemocracy.org and Henk van Ess 


In the second graph, we look at the similarities between the accounts. The larger circle and the smaller one, our target, are 
followed by many of the same sources. This is typical bot behaviour. In an army of bots, you follow each other. 


When we asked the Russian bot farm directly if we could use @gyroscope999 and @adjust_ps for spreading political 
information, they claimed that they owned both. 


Tip 7: Connect a made up Twitter handle to a real social media account 
An anonymous Twitter user can become a real person with a full name on Facebook — via Foursquare. 


People often use the same online nicknames in social media. Using this pattern allows us to find additional information. 
Replacing “twitter” with “foursquare” in a user’s profile url will get us a link to someone’s Facebook profile (and in this case, 
the full name). 
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Finding real names via Foursquare 


O > 


Your browser does not currently recognize any of the video formats 
available. 


Click here to visit our frequently asked questions about HTML5 video. 


B ò 0:00/0:18 % YouTube 


Tip 8: Find a social score 


It’s not perfect, but a social score helps you establish if a Twitter account is dead or alive. By inserting the Twitter handle 
(without the “@”) after klout.com/ you can find the social ranking of the user, which can help to decide whether the account 
is genuine or not. 


Search engine for social media 


Q > 


60% 


Your browser does not currently recognize any of the video formats 
available. 


Click here to visit our frequently asked questions about HTML5 video. 


2 % Youlube © 


Klout will give you some insight into what impact a user has on Twitter. You can earn 0 to 100 points. If your favorite source 
has a score of 0-10, be at least suspicious if they claim to be an expert. 


If the score is 60 or higher, the source is well established in Twitter and gets a reasonable amounts of retweets. (Your Klout 
score may have an effect on how your Twitter help desk interactions play out.) 


Bernd Luge 


With a Klout score of 61, Bernd Luge, supporter of the AfD in Germany, seems not to be a bot. Professional bots try to hide 
their real reason of existence by being completely normal for months, hoping to get a high social score. Adjust _ps, for 
instance, doesn’t score like a normal bot, making him almost undetectable to Twitter. 


Sooner or later, however, bots will spit random stuff, which you can check out via Klout too. Our target’s major 
concentrations include convertibles, copyright law, and flash drives — at the very least an eclectic mix. 


Tip 9: How alive is the bot? 


I always run Twitter accounts through Social Mention to get a faster insight on how (and whether) the user is communicating 
with other users. In our case, @Adjust_ps has only interacted with an Alexander (via a fake profile) — and yes, Alexander is 
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one of the 31 staffers of our Russian bot farm. 


Finding fake bots with Klout 


Q > 


Your browser does not currently recognize any of the video formats 
available. 


Click here to visit our frequently asked questions about HTML5 video. 


% Youlube :ı 


Tip 10: When (and how) is your bot tweeting? 


With Account Analysis you can get detailed insights into how the user tweets. 


Checking tweet times & client 


Q A 


Your browser does not currently recognize any of the video formats 


70% s 
available. 


Click here to visit our frequently asked questions about HTML5 video. 


B ù 0:00/0:14 &æ Youlube 


Our target tweets regularly and throughout the day. @Adjust_ps used a mobile phone only twice to tweet. The rest of time he 
used a web browser (“Twitter”) or shared YouTube videos. 


Tweeting like this can be a sign of humanity — or a way well-programmed bots can avoid spam detection. 


ogm 
. Henk van Ess 
= 
Henk van Ess is a Dutch researcher , internet skills consultant and trainer specializing in social media and data journalism. His work has 
appeared in BBC, PBS and GIJN and he works for the online research start-up Bellingcat. 
Comments 
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Sorry, the browser you are using is not currently supported. Disqus actively supports the following browsers: 


e Firefox 

e Chrome 

e Internet Explorer 11+ 
e Safari 


E Catte Adams * 3 hours ago 


Thank god THAT was simple. LOLOLOLOL 


@_  LevHorovitz - 2 hours ago 
Peay 


Alternatively you can go and do something interesting in real life, and ignore all this childish, time-wasting BS. 


Related News 
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Online hoaxes about the Catalan referendum Three months after launching, Faktisk is already 
concentrated on police action in Barcelona among the most popular sites in Norway 
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